CVE-2026-97471

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'args[link target]' parameter. This makes it possible for unauthenticated attackers to extract arbitrary user meta values for any user ID, including administrator email addresses, login names, wp user level, and WooCommerce customer PII such as billing email, billing phone, and billing address 1. The awb-instagram-nonce required to trigger this endpoint is printed in plaintext in fusionInstagramVars on any page rendering the [fusion instagram] shortcode, making it harvestable by any anonymous visitor before the exploit request is sent.